White Paper—10 CFR 50.59; the Process, Application to Substantial Modifications to Licensee Facilities, and NRC Staff Assessment of

Licensee Implementation EXECUTIVE SUMMARY The steam generator primary-to-secondary leak at San Onofre Nuclear Generating Station (SONGS), Unit 3, in 2012 generated significant public and congressional interest in the requirements related to facility changes. Many questions focused on how a licensee could substantially modify its facility without obtaining a license amendment (except for technical specification (TS) changes), relying instead on the licensee’s evaluation under Title 10 of the Code of Federal Regulations (10 CFR) 50.59, “Changes, Tests, and Experiments.” The U.S. Nuclear Regulatory Commission (NRC) staff prepared this white paper to describe the 10 CFR 50.59 process and its history, how licensees apply 10 CFR 50.59 criteria, and the relationship between 10 CFR 50.59 and other regulatory requirements. Regulations in 10 CFR 50.59 establish the conditions under which licensees may make changes to their facility or procedures and conduct tests or experiments without prior NRC approval. Other processes beyond 10 CFR 50.59 also contribute to determining the safety of a planned activity, or determining whether other regulatory requirements are met. These additional, established requirements and processes include elements of procedure review, quality assurance requirements (which include design control, vendor oversight, corrective actions, and document control), technical specifications, post-modification testing, surveillance testing, in-service inspections, radiation protection program requirements, etc., which must be adhered to by licensees. The licensee is responsible for operating the plant safely in accordance with NRC regulations irrespective of whether NRC approval of a change test or experiment is required. It is important to distinguish between licensee design reviews for safety and licensee 10 CFR 50.59 reviews, which are for different purposes and require different approaches. Licensees are required to design, purchase, fabricate, and test structures, systems, and components, which include large or complex component replacements, in accordance with Appendix B, “Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants,” to 10 CFR Part 50, “Domestic Licensing of Production and Utilization Facilities.” The 10 CFR 50.59 regulations provide a threshold for determining when NRC approval of changes, tests, or experiments is necessary to preserve the basis on which the NRC issued the facility operating license. The NRC staff assessed the 10 CFR 50.59 process, how licensees apply the 10 CFR 50.59 criteria, the relationship of 10 CFR 50.59 to other regulatory requirements, and 10 CFR 50.59 findings and violations. The NRC staff examined all findings and violations related to 10 CFR 50.59 between January 2000 and December 2012 to evaluate whether licensees are applying the 10 CFR 50.59 process correctly. The NRC staff found that no findings related to 10 CFR 50.59 rose above the level of non-cited violations (NCVs) of very low safety significance (Green), and none of the findings contributed to any additional or more safety significant issue at the facility. This white paper provides a broad NRC staff assessment of the 10 CFR 50.59 process while also detailing how licensees apply the 10 CFR 50.59 process to steam generator replacements because of the heightened interest following the SONGS tube leak event. The NRC staff reviewed all steam generator replacement operating experience between January 2000 and

- 2 -

February 2013. One minor 10 CFR 50.59 violation dealt with the design of replacement steam generators. All other steam generator replacement-related findings and violations fell outside the 10 CFR 50.59 process, involved containment structure and concrete issues, and were of very low safety significance. This assessment led the NRC staff to conclude that overall, licensees continue to apply the 10 CFR 50.59 criteria correctly to changes, tests, and experiments at their facilities. The NRC staff also concluded that applying the 10 CFR 50.59 process to substantial plant modifications, including steam generator replacements, serves the underlying purpose of the 10 CFR 50.59 regulation as described by the Commission in its statements of consideration for the 1999 final rule1 by establishing a threshold for NRC review of changes that could affect the basis on which the NRC issued a license to operate the facility. Nationwide, licensees conduct a combined total of about 49,000 10 CFR 50.59 screenings and evaluations2 per year. Given that licensees make many changes throughout the facilities’ operational lifetime, the criteria in 10 CFR 50.59 focus NRC staff attention on those changes that have regulatory or safety significance. INTRODUCTION This white paper describes the following: (1) the 10 CFR 50.59 process and process history (2) the relationship of 10 CFR 50.59 to other regulatory requirements (3) the application of 10 CFR 50.59 (4) steam generator replacement history (5) the NRC staff’s assessment of 10 CFR 50.59 inspection results This white paper is based on existing information and does not contain any new policies, guidance, or interpretations with respect to 10 CFR 50.59 or any other topic. 10 CFR 50.59 PROCESS AND PROCESS HISTORY The intent of the 10 CFR 50.59 process is to permit licensees to make changes to the facility without NRC approval through a license amendment, provided the changes maintain acceptable levels of safety as documented in the safety analysis report. The 10 CFR 50.59 process was thus structured around the licensing approach of design basis events (anticipated operational occurrences and accidents), safety-related mitigation systems, and consequence calculations for the design basis accidents. Through 10 CFR 50.59, the NRC ensures that changes made by the licensee which could affect the basis for licensing the facility are submitted for NRC review and approval, and the threshold for requiring such NRC approval provided by the criteria

1 U.S. Nuclear Regulatory Commission, “Changes, Tests, and Experiments: Final Rule,” Federal

Register, Vol. 64, No. 191, October 4, 1999, pp. 53,582. 2 A “10 CFR 50.59 evaluation” is the documented evaluation against the eight criteria in

10 CFR 50.59(c)(2) to determine if a proposed change, test, or experiment requires prior NRC approval through a license amendment under 10 CFR 50.90, “Amendment of License or Construction Permit at Request of Holder.” Screening is that part of the 10 CFR 50.59 process for determining whether a proposed activity requires a 10 CFR 50.59 evaluation to be performed. The definitions in 10 CFR 50.59(a) of “change,” “facility as described…,” “procedures as described…,” and “test or experiment not described…” constitute criteria for the 10 CFR 50.59 screening process.

- 3 -

of 10 CFR 50.59 ensures adequate protection of public health and safety.3 The licensee determines whether a change meets the criteria of 10 CFR 50.59 and may be made without prior NRC approval. Regulations in 10 CFR 50.59 are, thus, a regulatory threshold, determining when NRC prior approval of a change is needed, rather than a safety or acceptability test. The NRC conducts periodic inspections to monitor the effectiveness of licensee implementation of the 10 CFR 50.59 process and permanent plant modifications, which provides assurance the licensee has obtained the required license amendments. The NRC issued 10 CFR 50.59 in 1962. The need for 10 CFR 50.59 arose from the requirement added in 1957 to the Atomic Energy Act of 1954 (the Act) specifying that the Commission hold mandatory hearings for all proceedings on construction permits and operating licenses and the Atomic Energy Commission’s (AEC’s) belief that this requirement also applied to all amendment proceedings. During the same period, the AEC had begun the practice of incorporating the entire safety analysis report (then called the “hazards summary report”) into the license as TS because once the license was issued, the AEC did not require further updates to the report and did not have any requirements to control subsequent changes to the report. In 1960, the Commission recognized that the combination of incorporating the entire hazards summary report into a license as TS, together with the mandatory hearing requirement for all amendments, whether any person requested a hearing or not, no matter how minor, was a burdensome, unworkable process for controlling license requirements. There was a need for a more discriminating way to differentiate between those changes that require the same review as the initial permit or operating license would entail and those that do not raise sufficiently significant issues of safety to justify such time and effort. The substance of 10 CFR 50.59 first appeared as a condition in the license for the Vallecitos facility, and the thrust of those license provisions survives today in the current version of the regulation. In 1962, the NRC issued 10 CFR 50.59 and Congress revised the Act to remove the requirement for mandatory hearings in uncontested operating license proceedings. The process was structured around the licensing approach of design basis events (anticipated operational occurrences and accidents), safety-related mitigation systems, and consequence calculations for the design basis accidents. The process also considered the effect facility changes would have on margins and equipment functionality, reliability, and availability. In 1968, the NRC revised 10 CFR 50.59 to add a criterion to require prior NRC approval if the margin of safety as defined in the basis for any technical specification is reduced.4 In 1995, the NRC recognized that a plant5 had conducted refueling outages outside its design bases described in its updated final safety analysis report. This recognition led to questions about the regulatory framework, which initiated an NRC staff review of the 10 CFR 50.59 process. This review found that the language of the rule was not clear, leading the NRC staff and licensees to interpret the rule differently and to have different expectations about its implementation. Therefore, the NRC conducted rulemaking to clarify the requirements and to provide a limited degree of flexibility to licensees to make certain changes that only “minimally” increase the probability or consequences of accidents. 3 Id. 4 U.S. Nuclear Regulatory Commission, “Changes, Tests, and Experiments,” Federal Register,

Vol. 30, December 17, 1968, pp. 18610. 5 Thompson, Hugh L., acting executive director for operations, to the Commissioners, “Millstone

Lessons Learned Report, Part 2: Policy Issues,” February 12, 1997, Agencywide Documents Access and Management System (ADAMS) Accession No. ML992920106.

- 4 -

In October 1998, the Commission published its proposed updated 10 CFR 50.59 rule stating the following:

Too stringent an interpretation of the meaning of the requirements could result in diversion of licensee and staff resources for review of inconsequential changes. Too high a threshold for NRC review could lead to erosion of safety margins without NRC review, particularly from the cumulative effect of more than one change. In developing the proposed rule, the Commission has carefully weighed these matters in trying to establish an appropriate threshold for NRC review. . .. Margins and equipment functionality, reliability and availability also may be impacted by facility changes. Therefore, the criteria for requiring NRC approval were directly related to: (1) Preserving licensing assumptions concerning initiation of design basis events by not allowing a different type of initiating event or probability of occurrence larger than previously considered; (2) preserving effectiveness (reliability) of the mitigation systems by not allowing introduction of different equipment malfunctions and by limiting increases in probability of malfunction, or reductions in the margin of safety (which reflects the capability of the system); and (3) preserving acceptability of consequences by limiting increases in consequences of the postulated design basis events.6

The following criteria of 10 CFR 50.59 were developed. The body of this white paper provides further discussion on licensees’ application of the criteria. • 10 CFR 50.59(c)(1) authorizes a licensee to make changes in the facility or procedures

described in its final safety analysis report (FSAR) (as updated) or perform tests or experiments not described in its FSAR (as updated) without obtaining a license amendment pursuant to 10 CFR 50.90, “Application for amendment of license, construction permit, or early site permit,” only if a change to the facility’s technical specifications is not required and if the change, test, or experiment does not meet any of the criteria in 10 CFR 50.59(c)(2).

• 10 CFR 50.59(c)(2) states that a licensee shall obtain a license amendment pursuant to

10 CFR 50.90 prior to implementing a proposed change, test, or experiment if the change, test, or experiment would:

(i) Result in more than a minimal increase in the frequency of occurrence of an

accident previously evaluated in the FSAR (as updated); (ii) Result in more than a minimal increase in the likelihood of occurrence of a

malfunction of a structure, system, or component important to safety previously evaluated in the FSAR (as updated);

(iii) Result in more than a minimal increase in the consequences of an accident previously evaluated in the FSAR (as updated);

6 U.S. Nuclear Regulatory Commission, “Changes, Tests, and Experiments: Proposed Rule,”

Federal Register, Vol. 63, No. 203, October 21, 1998, pp. 56098, 56100.

- 5 -

(iv) Result in more than a minimal increase in the consequences of a malfunction of a structure, system, or component important to safety previously evaluated in the FSAR (as updated);

(v) Create a possibility for an accident of a different type than any previously evaluated in the FSAR (as updated);

(vi) Create a possibility for a malfunction of a structure, system, or component important to safety with a different result than any previously evaluated in the FSAR (as updated);

(vii) Result in a design basis limit for a fission product barrier as described in the FSAR (as updated) being exceeded or altered; or

(viii) Result in a departure from a method of evaluation described in the FSAR (as updated) used in establishing the design bases or in the safety analyses

• The rule also specifies record-keeping and reporting requirements associated with such

changes, tests, or experiments. The NRC issued the final rule that adopted the above criteria on October 4, 1999; and it took effect on March 13, 2001.7 In its statements of consideration for the final rule, the Commission stated the following:

[Changes to 10 CFR 50.59] embodied in the Sec. 50.59(c)(2)(i), (ii), (iii), (iv), (v) and (vi) criteria will not result in changes approaching the adequate protection threshold without prior NRC review and approval. . . . Although the final rule allows minimal increases, licensees still must meet applicable regulatory limits and other acceptance criteria to which they are committed (such as are contained in Regulatory Guides and nationally recognized industry consensus standards, (e.g., the American Society of Mechanical Engineers (ASME) Boiler & Pressure Vessel Code and Institute of Electrical and Electronics Engineers (IEEE) Standards). Further, departures from the design, fabrication, construction, testing, and performance requirements as outlined in the General Design Criteria [GDC] (appendix A to part 50) are not compatible with a “no more than minimal increase” standard. . . . [The purpose of the 10 CFR 50.59 evaluation] is to identify possible changes that might affect the basis for licensing the facility so that any changes that might pose a safety concern are reviewed by NRC to confirm their safety before implementation.”8

In November 2000, the NRC issued corresponding Regulatory Guide (RG) 1.187, “Guidance for Implementation of 10 CFR 50.59, Changes, Tests, and Experiments,” (Agencywide Documents Access and Management System (ADAMS) Accession No. ML003759710). RG 1.187 7 U.S. Nuclear Regulatory Commission, “Changes, Tests, and Experiments: Final Rule,” Federal

Register, Vol. 64, No. 191, October 4, 1999, pp. 53582, as amended at “Minor Errors in Regulatory Text; Correction,” Federal Register, Vol. 66, No. 241, December 14, 2001, pp. 64737; “Changes, Tests, and Experiments: Confirmation of Effective Date and Availability of Guidance,” Federal Register, Vol. 65, No. 240, December 13, 2000, pp. 77773.

8 U.S. Nuclear Regulatory Commission, “Changes, Tests, and Experiments,” Federal Register, Vol. 64, No. 191, October 4, 1999, pp. 53584, 53589, 53611.

- 6 -

endorsed an industry document, Nuclear Energy Institute (NEI) 96-07, Rev. 1, “Guidelines for 10 CFR 50.59 Implementation,” also issued in November 2000, (ADAMS Accession No. ML003771157). Subsequently, the NRC issued Regulatory Issue Summary (RIS) 2001-03, “Changes, Tests, and Experiments,” (ADAMS Accession No. ML010040446), dated January 23, 2001, as guidance for making the transition to the requirements of the recently amended regulations in 10 CFR 50.59 and 10 CFR 72.48, “Changes, tests, and experiments.” The NRC also issued RIS 2002-22, “Use of EPRI/NEI Joint Task Force Report, ‘Guideline on Licensing Digital Upgrades: EPRI TR-102348, Revision 1, NEI 01-01: A Revision of EPRI TR-102348 to Reflect Changes to the 10 CFR 50.59 Rule,’” (ADAMS Accession No. ML023160044), dated November 25, 2002, that communicated the NRC’s endorsement of NEI 01-01 for use as guidance in designing and implementing digital upgrades to instrumentation and control (I&C) systems. RELATIONSHIP OF 10 CFR 50.59 TO OTHER REGULATORY REQUIREMENTS AND CONTROLS The NRC, through the Atomic Energy Act, ensures that the primary responsibility for the safety of a nuclear installation rests with the licensee. The NRC’s regulatory programs are based on the premise that the safety of commercial nuclear power reactor operations is the responsibility of NRC licensees. The Commission has noted that the purpose of having regulations is to flesh out the “adequate protection” standard and that compliance with such regulations and guidance may be presumed to assure adequate protection at a minimum.9 These regulations include 10 CFR 50.59 and quality assurance requirements for accomplishing changes to the facility. Under 10 CFR 50.59, the criteria for determining when licensees may make changes to the facility or procedures and conduct tests or experiments without prior NRC approval are established. Thus 10 CFR 50.59 provides a threshold for regulatory review—not the final determination of safety—of proposed activities. These determinations are treated within other established requirements and processes—such as elements of procedure review, quality assurance requirements (which includes design control, vendor oversight, corrective actions, and document control), TS, post-modification testing, surveillance testing, in-service inspections, radiation protection program requirements, etc., which must be adhered to by licensees. To reduce duplication of effort, 10 CFR 50.59(c)(4) specifically excludes from the scope of 10 CFR 50.59 changes to the facility or procedures that are controlled by other more specific requirements and criteria established by regulation including 10 CFR Part 50, Appendix B, “Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants,” 10 CFR 50.55a, “Codes and Standards,” 10 CFR 50.46, “Acceptance Criteria for Emergency Core Cooling Systems for Light-Water Nuclear Power Reactors,” and 10 CFR 50.12, “Specific Exemptions”. Activities controlled and implemented under other regulations may require related information in the updated final safety analysis report (UFSAR) to be updated. To the extent the UFSAR changes are directly related to the activity implemented via another regulation, applying 10 CFR 50.59 is not required. In addition, per 10 CFR 50.59(c)(1)(i), proposed activities that require a change to the technical specifications must be made via the license amendment process, 10 CFR 50.90. Only those aspects of proposed activities that are not directly related to the required technical specification change are subject to 10 CFR 50.59. 9 See, e.g., Revision of Backfitting Process for Power Reactors, Federal Register, Vol. 53,

June 6, 1988, pp. 20603, 20606.

- 7 -

The size and complexity of a change to the facility is not a specific factor in any of the eight criteria of 10 CFR 50.59(c)(2) for determining whether prior NRC approval is required. The licensee is responsible for operating the plant safely in accordance with NRC regulations independent of whether NRC approval is required. Licensees are required to design, purchase, fabricate, and test component replacements, including large or complex replacements, in accordance with the quality assurance requirements in 10 CFR Part 50, Appendix B. 10 CFR 50.59 provides a threshold for determining when NRC approval is required to preserve the basis on which the license was issued irrespective of whether the change is complex or simple. The NRC-endorsed 10 CFR 50.59 guidance in NEI 96-07, Rev. 1, describes only one aspect of the 10 CFR 50.59 process that is affected by the complexity of the activity and that is documentation. Specifically, NEI 96-07, Rev. 1, Section 5, “Documentation and Reporting,” states, “Thus the basis for the engineering judgment and the logic used in the determination should be documented to the extent practicable and to a degree commensurate with the safety significance and complexity [emphasis added] of the activity.” Quality Assurance The regulations in Appendix B to 10 CFR Part 50 require that all nuclear power plant licensees maintain a quality assurance program. Quality assurance comprises all those planned and systematic actions necessary for adequate assurance that structures, systems, and components will perform satisfactorily in service. Toward that end, Appendix B specifies 18 criteria that must be satisfied in a licensee’s quality assurance program. Appendix B also stipulates that licensees establish measures to ensure that applicable regulatory requirements, design bases, and other requirements that are necessary to ensure adequate quality, are suitably included or referenced in the documents for procurement of safety-related materials, equipment, and services whether purchased by the licensee or its contractors or subcontractors. Importantly, neither the 10 CFR 50.59 regulation nor the statements of consideration issued with the 1999 final rule describe 10 CFR 50.59 as a process for verifying design adequacy. Rather, the engineering/technical design evaluations supporting the change are developed using the licensee’s plant modification process that implements the requirements of 10 CFR Part 50, Appendix B, Criterion III, “Design Control.” This requirement states:

The design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, … by individuals or groups other than those who performed the original design.

NEI 96-07, Rev. 1, states:

After determining that a proposed activity is safe and effective through appropriate engineering and technical evaluations, the 10 CFR 50.59 process is applied to determine if a license amendment is required prior to implementation.

“Like-for-like” Replacements – “Like-for-like” means “the replacement of an item with one that is identical,” and is a term used in licensee procurement processes for the purchase of materials and equipment in accordance with the quality assurance requirements of 10 CFR 50, Appendix B. “Like-for-like” or equivalent items can be replaced as a maintenance activity and are not subject to 10 CFR 50.59 whereas replacement items that are not like-for-like or equivalent must be treated as a plant design change that is subject to 10 CFR 50.59.

- 8 -

Verification by Analysis, Surveillance, Testing and Inspection Licensees are required to verify they are operating their facilities in accordance with the requirements. The TS (for surveillance) and national consensus codes (for testing and periodic inspections) contain the requirements for verification. In 10 CFR 50.55a, the NRC lists requirements for applying industry codes and standards to nuclear power reactors during design, construction, and operation. Defense-in-Depth Philosophy The defense-in-depth philosophy, as applied in regulatory practice, requires that nuclear power plants contain a series of independent, redundant, and diverse safety systems. The physical barriers for defense-in-depth are the fuel matrix, the fuel rod cladding, the primary coolant pressure boundary (which includes steam generator tubes in pressurized-water reactors), and the containment. For steam generator tubes, defense-in-depth is provided by: • a conservative design and philosophy • procedures and operator training for responding to primary-to-secondary tube leakage • safety and protection systems for responding to primary-to-secondary tube leakage

events, including a steam generator tube rupture • accident analysis • TS-required steam generator tube inspections, assessments, and criteria for tube

plugging • operational programs, such as water chemistry control • TS-required instrumentation and limits on primary-to-secondary leakage rate • plant-specific probabilistic risk assessments include primary-to-secondary tube leakage

events • emergency preparedness As part of the plant licensing basis, applicants for pressurized-water reactor licenses are required to analyze the consequences of postulated design basis accidents such as steam generator tube rupture and main steamline break. These analyses consider the primary-to-secondary leakage through the tubing that may occur during these events, and the analyses must show that the offsite radiological consequences do not exceed the applicable limits of the 10 CFR Part 100, “Reactor site criteria,” guidelines for offsite doses. Oversight The NRC has a statutory responsibility for regulatory oversight to ensure that safety is maintained. NRC regulatory oversight for ensuring that each licensee meets its primary responsibility for the safety of a nuclear facility includes the (1) licensing process (e.g., license amendments required by 10 CFR 50.59 and 10 CFR 50.90); (2) Reactor Oversight Process (e.g., NRC inspections by resident and region-based inspectors); and (3) enforcement program (e.g., enforcement actions for failure to satisfy quality assurance requirements related to design control for changes to the facility). Specific to the 10 CFR 50.59 process, the NRC staff periodically inspects licensee implementation of the 10 CFR 50.59 process in accordance with a variety of NRC Inspection Procedures (IPs) including, but not limited to, IP 71111.17T, “Evaluations of Changes, Tests, and Experiments and Permanent Plant Modifications,” and IP 71111.22, “Component Design Bases Inspection.” The NRC inspection program covers

- 9 -

samples of licensee activities in any particular area and the sample sizes are specified in the inspection procedures. Additionally, the NRC allegation program provides a method for industry workers and members of the public to bring their concerns relating to safety or regulatory issues directly to the NRC to have them addressed. When a licensee submits a license amendment request per 10 CFR 50.90, the NRC staff evaluates the request against NUREG-0800, “Standard Review Plan [SRP] for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition,” which establishes criteria the NRC staff uses in evaluating whether a proposed licensing action meets the NRC’s regulations. The scope of the licensee’s license amendment request, and thus the scope of NRC review would normally only pertain to the details of the change that cause the license amendment to be required. APPLICATION OF 10 CFR 50.59 CRITERIA The following discussion provides an overview of how a licensee might apply the criteria of 10 CFR 50.59 for a typical steam generator replacement. For several of the criteria, the NRC staff also included examples of other facility changes that were known to have exceeded the stated criteria, thus requiring the licensee to submit a license amendment request. This overview does not contain any new policies, guidance, or interpretations with respect to 10 CFR 50.59 implementation. Before applying the criteria, the licensee first addresses the following question: “Does the proposed change, test, or experiment require a change to the technical specifications?” Any change to the TS requires the licensee to submit a license amendment request. The license amendment request would include only those details of the change related to the reason the license amendment was required (i.e., a change to TS). Other aspects of the change would be evaluated against the criteria of 10 CFR 50.59(c)(2). Licensees can use the NRC-endorsed 10 CFR 50.59 guidance in NEI 96-07, Rev. 1, to perform the 10 CFR 50.59 evaluations. Replacing steam generators has typically required a change to the TS, such as changes to the steam generator inspection and tube repair criteria (due to different tube material and other design changes) and changes to the peak containment post-accident pressure (due to a larger reactor coolant system (RCS) water volume). Following the evaluation on impacts on TS, the licensee then applies the following additional criteria regarding the question: “Does the change, test, or experiment meet any of the following criteria of 10 CFR 50.59(c)(2)?” (i) Result in more than a minimal increase in the frequency of occurrence of an accident

previously evaluated in the FSAR (as updated).

This criterion would require a license amendment prior to implementation if an activity causes the frequency of occurrence of an accident to change from one frequency class to a more frequent class; or, if the activity results in more than a 10 percent increase in the frequency or exceeds a frequency of 1 x 10-6 per year. The effect of a proposed activity on the frequency of an accident must be discernible and attributable to the proposed activity in order to exceed the more than minimal increase standard. If the proposed activity would not meet applicable NRC requirements as well as the design, material, and construction standards applicable to the structure, system, or component

- 10 -

(SSC) being modified, the change is considered to involve more than a minimal increase in the frequency of occurrence of an accident, and prior NRC approval is required.

Replacement steam generators would typically not require the licensee to obtain a license amendment under this criterion in cases where the replacement steam generators are designed, fabricated, inspected, and tested to an NRC-approved newer edition of the ASME Code and the reanalyzed accident analyses continue to meet acceptance criteria when accounting for replacement steam generator characteristics with the performance of mitigating SSCs within TS limits. For reanalyzed accident analyses, a change involving the UFSAR-specified method of evaluation must be evaluated using 10 CFR 50.59 criterion viii as described below.

(ii) Result in more than a minimal increase in the likelihood of occurrence of a malfunction of

a structure, system, or component important to safety previously evaluated in the FSAR (as updated).

This criterion would require a license amendment prior to implementation if the activity causes a malfunction of the SSC that affects the SSC’s ability to perform its intended design function and the likelihood of a malfunction is more than minimal. Qualitative engineering judgment and/or an industry precedent is typically used to determine if there is more than a minimal increase in the likelihood of occurrence of a malfunction. The effect of a proposed activity on the likelihood of malfunction must be discernible and attributable to the proposed activity in order to exceed the more than minimal increase standard. Although this criterion allows minimal increases, licensees must still meet applicable regulatory requirements and other acceptance criteria to which they are committed (e.g., RGs, the ASME B&PV Code, and IEEE standards). 10 CFR 50.59 evaluations of a proposed activity for its effect on likelihood of a malfunction would be performed at level of detail that is described in the UFSAR and the determination of whether the likelihood of malfunction is more than minimally increased is made at a level consistent with existing UFSAR described failure modes and effects analyses.

Malfunctions of SSCs are generally postulated as potential single failures but concurrent common cause failures of redundant components because of design deficiencies or manufacturing errors are considered beyond the design basis and are not evaluated in the UFSAR. Notwithstanding, the NRC-endorsed 10 CFR 50.59 guidance in NEI 01-01 states that the common cause failure vulnerability of digital safety I&C systems due to software errors could be considered as a special cause of single failure vulnerability, since the same software resides in the redundant channels of the system and a single undetected design error in the software could lead to a common cause failure of all redundant channels. For digital systems, the likelihood of software-related failure is minimized by basic approach of controlling the design, implementation, operation, and maintenance processes.

Replacement steam generators would typically not require the licensee to obtain a license amendment under this criterion in cases where changes involve the substitution of one type of component for another of similar function, provided all applicable design and functional requirements (including applicable codes, standards, etc.) continue to be met and any new failure modes are bounded by the existing analysis. In addition, the replacement steam generators are designed to perform the same design functions as those currently performed by the original steam generators, and the differences would

- 11 -

typically not affect their ability to perform these design functions. The design functions specified in the UFSAR for steam generators are: (1) function as a part of the reactor coolant pressure boundary (2) transfer heat between the RCS and the main steam system, and (3) remove heat from the RCS to achieve and maintain safe shutdown following postulated accidents.

Some components in the replacement steam generators typically are constructed from different materials when compared to the original steam generators. These differences often represent a vast improvement over the original steam generator materials in terms of corrosion resistance.

The design of the replacement steam generator internal components (e.g., number of tubes, tube expansion method, support configuration, feedwater ring) is often different from those for the original steam generator components. These differences typically represent functional and material improvements over the original steam generator components. These design differences may result in different secondary side thermal hydraulic conditions. The NRC-approved 10 CFR 50.59 guidance states that engineering, design and other technical information concerning the activity and affected SSCs should be used to assess whether the activity affects a design function of an SSC.

In January 2012, a steam generator primary-to-secondary leak occurred at SONGS Unit 3. NRC inspection reports10 state that SONGS Unit 3 steam generators experienced excessive vibration of tubes that resulted in tubes rubbing against each other causing excessive wear and loss of structural integrity. The vibration was caused by the steam conditions in the U-bend region of the steam generators coupled with a lack of effective in-plane tube support. The thermal hydraulic conditions on the secondary side of the steam generator were underestimated during the design phase. As a result of this and other factors, the SONGS replacement generators were not designed with adequate thermal hydraulic margin to preclude the onset of a phenomenon called “fluid-elastic instability” which was a significant contributor to the tube-to-tube wear resulting in the tube leak. The NRC inspection team concluded that based on the UFSAR description of the original steam generators, the steam generators’ major design changes were appropriately reviewed in accordance with the 10 CFR 50.59 requirements.

While the 10 CFR 50.59 process is and remains an effective and viable regulatory tool, selective NRC inspections consistent with safety significance and inspection resources are performed in the following areas: (1) industry operating experience and how the licensee incorporated lessons learned from other plants (such as SONGS); (2) an evaluation of design and fabrication changes between the original and replacement generators; and (3) an evaluation of the licensee’s oversight of the steam generator vendor including an evaluation of any independent assessments done by the licensee.

10 Collins, Elmo E., regional administrator, to Peter Dietrich, senior vice president and chief nuclear

officer, Southern California Edison Co., “San Onofre Nuclear Generating Station—NRC Augmented Inspection Team Report 05000361/2012007 and 05000362/2012007,” July 18, 2012, and “San Onofre Nuclear Generating Station—NRC Augmented Inspection Team Follow-Up Report 05000361/2012010 and 05000362/2012010,” November 9, 2012, ADAMS Accession Nos. ML12188A748 and ML12318A342, respectively.

- 12 -

The quality assurance requirements in 10 CFR Part 50 specify that measures shall be established to assure that conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and nonconformances are promptly identified and corrected. The NRC-approved 10 CFR 50.59 guidance states, “After determining that a proposed activity is safe and effective through appropriate engineering and technical evaluations, the 10 CFR 50.59 process is applied to determine if a license amendment is required prior to implementation.” For example, if a properly performed thermal hydraulic calculation shows a reduction in thermal margin, the licensee’s 10 CFR 50.59 evaluation would provide the bases for the determination that the change, test or experiment does not require a license amendment.

Although this criterion would typically not require an amendment for steam generator replacements (a substantial modification), this criterion can and has resulted in license amendment requests for other facility changes. For example, a licensee submitted a license amendment request to change the UFSAR to identify that operator action might be necessary to ensure containment design pressure is not exceeded subsequent to a high energy line break such as a loss-of-coolant-accident.

(iii) Result in more than a minimal increase in the consequences of an accident previously

evaluated in the FSAR (as updated).

This criterion would require a license amendment prior to implementation if the activity will increase doses either to the public or to control room operators such that (1) the dose increase is more than 10 percent of the difference between the existing value and the regulatory guideline value in 10 CFR 100 and GDC 19, “Control Room,” as applicable, or (2) the SRP guideline value for the design basis event is reached and exceeded, or (3) if the current calculated dose consequences are already in excess of the SRP guidelines for some events, minimal increase is defined as less than or equal to 0.1 rem. Replacement steam generators would typically not require the licensee to obtain a license amendment under this criterion where the replacement steam generators would not significantly affect the dose consequences of accidents involving the secondary system, namely the main steam line break and steam generator tube failure. The aspects of the replacement steam generator design change that affect the accident dose consequences are changes in RCS and secondary side volumes. The major dose contribution is from reactor coolant leakage into the secondary system and therefore, the parameters that affect dose are reactor coolant leakage rate into the secondary system and the reactor cooldown period. Assuming the same concentration of radionuclides and pre-existing leak rate into the secondary system, any increase in estimated dose consequences is expected to be minimal. Although this criterion would typically not require an amendment for steam generator replacements (a substantial modification), this criterion can and has resulted in license amendment requests for other facility changes that were much smaller in scope and complexity. In one example, a licensee obtained an amendment because the changes in alternate source term assumptions resulted in an increase in dose for the loss-of-coolant accident analysis that was more than 10 percent of the difference between the current calculated value in the UFSAR and the regulatory guideline value.

- 13 -

(iv) Result in more than a minimal increase in the consequences of a malfunction of an SSC important to safety previously evaluated in the FSAR (as updated). The guidance for determining whether a proposed activity results in more than a minimal increase in the consequences of a malfunction is the same as that for accidents (criterion iii). As such, the reason replacement steam generators would not typically require NRC approval under this criterion is the same as described above under criterion iii.

(v) Create a possibility for an accident of a different type than any previously evaluated in the FSAR (as updated). This criterion would require a license amendment prior to implementation if there are credible potential failure modes for the affected SSC that could be introduced by implementation of the activity; and, these failures can initiate an accident; and, these accidents are of a similar or greater frequency and significance to those already included in the UFSAR; and, these accidents are not already included in the UFSAR or are not bounded by an accident already included in the UFSAR. A change or activity which increases the frequency of an accident previously thought to be incredible to the point where it becomes as likely as the accidents in the UFSAR, could create the possibility of an accident of a different type. For example, scenarios involving multiple or cascading steam generator tube ruptures have been analyzed extensively and were found to be of such low probability that they may not have been considered part of the design basis. However, if a change or activity is proposed such that a multiple or cascading steam generator tube rupture becomes credible, the change or activity could create the possibility of an accident of a different type. Replacement steam generators typically would not require the licensee to obtain a license amendment under this criterion as long as the licensee substitutes one type of component for another of similar function, provided all applicable design and functional requirements (including applicable codes, standards, etc.) continue to be met and there are no new failure modes introduced. Specifically, the replacement steam generators are designed to perform the same design functions as those currently performed by the original steam generators, and the differences do not affect their ability to perform these design functions. Some of the components in the replacement steam generators typically are constructed from different materials when compared to the original steam generators. These differences often represent a vast improvement over the original steam generator materials in terms of corrosion resistance.

The design of the replacement steam generator internal components (e.g., number of tubes, tube expansion method, support configuration, feedwater ring) is often different from those for the original steam generator components. These differences typically represent functional and material improvements over the original steam generator components. These design differences may result in different secondary side thermal hydraulic conditions. In such cases, licensees typically describe that reanalyzed events continue to meet acceptance criteria when accounting for replacement steam generator characteristics with the performance of mitigating SSCs within technical specification limits. For evaluated events that were not reanalyzed, licensees typically describe that the existing analyses remain applicable.

- 14 -

(vi) Create a possibility for a malfunction of a structure, system, or component important to

safety with a different result than any previously evaluated in the FSAR (as updated).

This criterion would require a license amendment prior to implementation if there are credible potential failure modes for the affected SSC that could be introduced by implementation of the activity that can cause an SSC to malfunction; and, these malfunctions and the results of these malfunctions are not already considered by the UFSAR including the failure modes and effects analyses (FMEAs) in the UFSAR; and, these malfunctions have different effects in which the results are not bounded by those already addressed by the UFSAR including the FMEAs. The design of the replacement steam generator internal components (e.g., number of tubes, tube expansion method, support configuration, feedwater ring) is often different from those for the original steam generator components. These differences typically represent functional and material improvements over the original steam generator components. These design differences may result in different secondary side thermal hydraulic conditions. In addition, malfunctions, such as a tube failure, are already considered in the UFSAR and the effects would be the same and are already addressed in the UFSAR. Although this criterion would typically not require an amendment for steam generator replacements (a substantial modification), this criterion can and has resulted in license amendment requests for other facility changes that were much smaller in scope and complexity. In one example, a licensee submitted a proposed amendment requesting NRC approval to operate transformer load tap changers in the automatic mode. NRC approval was required because malfunctions of newly installed microcontrollers could automatically raise the voltage on safety-related electrical busses, a condition that had not been previously evaluated in the UFSAR, with results that were not bounded by other UFSAR evaluations.

(vii) Result in a design basis limit for a fission product barrier as described in the FSAR (as

updated) being exceeded or altered; This criterion would require a license amendment prior to implementation if implementation of the activity impacts any parameter which is crucial to a fission product barrier’s integrity; and either (i) the predicted value for the parameter exceeds the design basis limit for a fission product barrier; or, (ii) the design basis limit itself for a fission product barrier is changed. Design basis limits are the limiting values for parameters that directly determine the performance of a fission product barrier. Design basis limits that could be affected by steam generator replacements are RCS pressure, RCS stresses, RCS heatup/cooldown, and containment pressure. The design basis limits for RCS stresses and RCS heatup/cooldown are commonly controlled by 10 CFR 50.55a, 10 CFR 50.46, and/or a specific TS, and therefore would not be subject to 10 CFR 50.59. For RCS pressure, licensees would typically demonstrate that reanalyzed events do not result in this design basis limit being exceeded or altered when accounting for replacement steam generator characteristics with the performance of mitigating SSCs within TS limits. For evaluated events that were not reanalyzed, licensees would typically demonstrate that existing analyses remain applicable.

- 15 -

Changes in containment pressure can occur with replacement steam generators because of increased RCS water volume and would require a TS amendment.

(viii) Result in a departure from a method of evaluation described in the FSAR (as updated)

used in establishing the design bases or in the safety analyses.

This criterion would require a license amendment prior to implementation if: (1) the activity revises or replaces any method of evaluation (defined as

calculational framework) that is explicitly described in the FSAR that is used to predict plant performance; and

(2) the method of evaluation either is used to demonstrate that plant performance will meet a design basis or is used as part of a safety analysis in the UFSAR; and

(3) either (a) implementation of the activity changes a method of evaluation described

in the UFSAR to another method (i.e., replaces or adopts a new method of evaluation) and, the new method of evaluation had not been previously approved by the NRC for the intended application; or

(b) implementation of the activity changes any of the elements of the currently specified method of evaluation described in the UFSAR (i.e., revises an existing UFSAR method of evaluation) and, the results of the revised method are neither conservative nor essentially the same.

Replacing steam generators involves performing calculations, which can involve revising or replacing a method of evaluation. These include the tube wall thinning evaluation, a main steam line break mass-energy release analysis, calculation of peak forces acting on the replacement steam generator tubes, calculation of tube displacement histories, calculation of tube stresses, RCS structural analysis, and containment pressure-temperature analysis. A license amendment would not be required if the method of evaluation is not explicitly described in the UFSAR or is not used either to demonstrate that plant performance will meet a design basis or as part of a safety analysis in the UFSAR. For instance, if the UFSAR does not specify the thermal-hydraulic code used for the design of the original steam generators, using a different thermal-hydraulic code for the replacement steam generators would not constitute a change in methodology or a change in an element of a methodology described UFSAR and therefore, would not require a license amendment. In addition, a license amendment would not be required if the licensee can demonstrate that (1) for each method of evaluation in the UFSAR that is replaced with another method, the new method has been approved by the NRC and is applicable to this plant, and (2) for each revised method of evaluation, the results are conservative or essentially the same.

Although this criterion would typically not require an amendment for steam generator replacements (a substantial modification), this criterion can and has resulted in license amendment requests for other facility changes that were much smaller in scope and complexity. For example, a licensee submitted a license amendment request that would modify the method used to calculate the available net positive suction head for the recirculation spray pumps as described in the UFSAR.

- 16 -

STEAM GENERATOR REPLACEMENT HISTORY Since 1989, licensees have replaced their steam generators under 10 CFR 50.59, that is, without the need for a license amendment (other than for TS changes). Steam generators have been replaced in 54 of the 65 operating pressurized-water reactors. Substantial NRC inspection resources have been assigned to the review of the replacement of steam generators including the inspection of heavy loads, main coolant piping welds, containment repairs, and the licensee’s application of 10 CFR 50.59. Replacement steam generators incorporate design enhancements that make the tubes less susceptible to degradation. These include using stainless steel tube support plates to minimize the likelihood of denting and fabrication techniques to minimize mechanical residual stresses in the tubes. The Steam Generator Program contained in a plant’s TS provides requirements for managing tube degradation in operating steam generators by requiring tube inspections be performed to identify degraded tubes; plugging tubes that are degraded to the specified limit; and, determining the operating interval to provide reasonable assurance of tube integrity until the next inspection. Tube integrity is needed to ensure the steam generator performs its intended safety function (i.e., the tubes are the primary barrier between the radioactive and nonradioactive sides of the plant). The NRC also provides oversight and monitoring of the operation of replacement steam generators through the following: 1) regional activities, including, but not limited to, onsite regional inspectors and regional

inspectors who review licensees’ in-service inspection programs and steam generator replacement projects

2) NRC headquarters activities including, but not limited to, discussions with selected licensees during outages, review of steam generator inspection reports submitted by licensees, and on an as-needed basis, meetings with licensees to discuss inspection results

3) industry interactions (semiannual meetings with the steam generator community) 4) research activities, including the international steam generator tube integrity program The NRC staff compiled steam generator operating experience for a subset of operating plants up to December 2001 in NUREG-1771,11 “U.S. Operating Experience with Thermally Treated Alloy 600 Steam Generator Tubes,” and for a different subset of operating plants up to December 2004 in NUREG-1841, “U.S. Operating Experience with Thermally Treated Alloy 690 Steam Generator Tubes” (ADAMS Accession Nos. ML031140081 and ML072330588, respectively). These NUREGs summarized the operating experience, up to the point of the NUREGs publications, associated with all but one of the steam generators replaced in the United States. Of those replacements described in these NUREGs, approximately 14 experienced issues such as primary-to-secondary leakage (because of a loose part, fabrication flaw, or foreign object), chemical contaminants inadvertently introduced into the steam generators, and non-safety significant wear indications. None of the plants described in these NUREGs exceeded the TS limit for primary-to-secondary leakage or failed to satisfy the TS tube integrity performance criteria.

11 Note: NUREG-1771 also includes original steam generator with second-generation tube

material/heat treatments (thermally treated Alloy 600 (600TT)).

- 17 -

NRC STAFF’S ASSESSMENT OF 10 CFR 50.59 INSPECTION RESULTS The NRC staff compiled and assessed all 10 CFR 50.59-related findings12 and violations, which include substantial modifications to licensee facilities, such as steam generator replacements and reactor vessel head replacements, for the period from January 2000 to December 2012,13 to evaluate whether licensees are applying 10 CFR 50.59 correctly. The NRC staff identified 138 findings and violations related to the licensees’ application of 10 CFR 50.59 (ADAMS Accession No. ML13094A257). The NRC staff found that none of the 10 CFR 50.59-related findings rose above the level of non-cited violations (NCVs) of very low safety significance (Green), and none of the findings contributed to any additional or more safety significant issue at the facility. Please refer to the table below for more specifics regarding the findings and NCVs.

50.59 Issue Identified Green Finding

No Color Finding

No Color NCV

Green NCV

Inadequate 50.59 Evaluation 1 55

Failure to Perform or Document a 50.59 Evaluation

2 1 1 45

Failure to Obtain Prior NRC Approval or License Amendment

3 23

Failure to Perform Adequate 50.59 Screening

1 4

Failure to Conclude Change Required Prior NRC Approval

2

Total 7 1 1 129

Anecdotally, licensees conduct about 475 10 CFR 50.59 screenings per unit per year, and about five 10 CFR 50.59 evaluations per unit per year for a nationwide combined total of about 49,000 screenings and evaluations per year. These screenings and evaluations are the tools licensees use to evaluate whether a change, test, or experiment conducted at its facility requires prior NRC approval via a license amendment. The vast majority of license amendment requests involve technical specification changes. The number of license amendment requests based solely from the 8 criteria in 10 CFR 50.59 is about 1 per site every 10 years. In addition, the NRC staff reviewed all steam generator replacement operating experience (for the period from January 2000 to February 2013). The NRC staff found that there was one minor 10 CFR 50.59 violation related to the design of the replacement steam generators. All other steam generator replacement-related findings and violations involved the containment structure and concrete issues, all were of very low safety significance, and none involved 10 CFR 50.59.

12 “Finding” is defined as performance deficiency of more-than-minor significance. A finding may or

may not result in a violation. 13 10 CFR 50.59 was amended in December 2000 to include the eight criteria, which took effect on

March 13, 2001. Federal Register, Vol. 65, No. 240, December 13, 2000, pp. 77773.

- 18 -

CONCLUSIONS This white paper provided the NRC staff’s assessment of the appropriateness of 10 CFR 50.59 for substantial modification to licensee facilities, including steam generator replacements, by describing the following: (1) the 10 CFR 50.59 process and process history (2) the relationship of 10 CFR 50.59 to other regulatory requirements (3) the application of 10 CFR 50.59 (4) steam generator replacement history (5) the NRC staff’s assessment of 10 CFR 50.59 inspection results Based on the results of this review, the NRC staff concluded that overall, licensees continue to correctly apply the criteria in 10 CFR 50.59 to changes, tests, and experiments at their facilities, consistent with the spirit and intent of the statements of consideration issued with the 1999 final rule for 10 CFR 50.59 by establishing a threshold for NRC review of changes that could impact the basis on which the NRC issued a license to operate the facility. Nationwide, it is estimated that licensees conduct a combined total of about 49,000 10 CFR 50.59 screenings and evaluations per year. This equates to 588,000 screenings and evaluations in the 12-year period reviewed, and only 138 very low safety significant problems with the use of 10 CFR 50.59. Given that licensees make many changes throughout the facilities’ operational lifetime, the criteria in 10 CFR 50.59 focus NRC staff attention on those changes that have regulatory or safety significance. It is important to restate that the 10 CFR 50.59 review process does not constitute the sole determination of safety of a planned activity, or the determination of whether other regulatory requirements are met. Licensees must also adhere to other established requirements and processes beyond 10 CFR 50.59 including elements of procedure review, quality assurance requirements (which include design control, vendor oversight, corrective actions, and document control), technical specifications, post-modification testing, surveillance testing, in-service inspections, and radiation protection program requirements. CONTACT: David Beaulieu, NRR/DPR 301-415-3243